Subdomain Discovery Engine

Subdomain Discovery Engine — Multi-Source Passive Enumeration

Tool for passive subdomain enumeration that aggregates results from multiple sources:

• Certificate Transparency — Queries crt.sh, Certspotter, and Google CT logs for all certificates issued to the target domain and its subdomains.
• Search Engines — Extracts subdomains from Google, Bing, and Baidu search results using automated dorking (site:*.target.com).
• DNS Databases — Queries SecurityTrails, VirusTotal, AlienVault OTX, ThreatCrowd, and PassiveTotal for historical DNS records.
• Archive Sources — Scrapes Wayback Machine (web.archive.org) for historically referenced subdomains no longer in active DNS.
• Validation — Resolves all discovered subdomains against multiple DNS servers, detects wildcard DNS entries, and filters false positives.
• Reporting — Outputs deduplicated list with IP addresses, CDN detection, and HTTP/HTTPS response status for each live subdomain.